omegga 1.5.2 → 1.6.0

package/dist/webserver/backend/index.js

@@ -11,7 +11,10 @@ const http = require("http");
 const https = require("https");
 const NedbStore = require("nedb-promises-session-store");
 const path = require("path");
+const bcrypt = require("bcryptjs");
+const server$1 = require("@simplewebauthn/server");
 const database = require("./database.js");
+const totp = require("./totp.js");
 const metrics = require("./metrics.js");
 const index = require("./router/index.js");
 const server = require("./router/server.js");
@@ -24,6 +27,7 @@ const error = (...args) => logger.default.error(...args);
 class Webserver {
   // create a webserver
   constructor(options, omegga) {
+    this.lastReportedStatus = null;
     this.port = Number(
       options.port || process.env.OMEGGA_PORT || softconfig.default.DEFAULT_PORT
     );
@@ -129,14 +133,125 @@ class Webserver {
       }
       if (user) {
         req.session.userId = user._id;
-        req.session.save();
-        res.status(200).json({});
+        if (user.totpEnabled) {
+          req.session.mfaPending = true;
+          req.session.save();
+          res.status(200).json({ mfaRequired: true });
+        } else {
+          req.session.save();
+          res.status(200).json({});
+        }
       } else {
         res.status(404).json({ message: "no user found" });
       }
     });
+    const mfaAttempts = /* @__PURE__ */ new Map();
+    openApi.post("/auth/mfa/totp", async (req, res) => {
+      if (!req.session.mfaPending || !req.session.userId) {
+        return res.status(400).json({ message: "no pending MFA challenge" });
+      }
+      const sid = req.sessionID;
+      const attempt = mfaAttempts.get(sid) ?? { count: 0, lockedUntil: 0 };
+      if (Date.now() < attempt.lockedUntil) {
+        return res.status(429).json({ message: "too many attempts, try again later" });
+      }
+      const { code } = req.body ?? {};
+      if (typeof code !== "string") {
+        return res.status(422).json({ message: "code required" });
+      }
+      const user = await this.database.findUserById(req.session.userId);
+      if (!user || !user.totpSecret) {
+        return res.status(400).json({ message: "MFA not configured" });
+      }
+      let verified = false;
+      if (totp.verifyToken(code, user.totpSecret)) {
+        verified = true;
+      }
+      if (!verified && user.recoveryCodes?.length) {
+        for (const hashedCode of user.recoveryCodes) {
+          if (await bcrypt.compare(code, hashedCode)) {
+            await this.database.removeRecoveryCode(user.username, hashedCode);
+            verified = true;
+            break;
+          }
+        }
+      }
+      if (verified) {
+        mfaAttempts.delete(sid);
+        delete req.session.mfaPending;
+        req.session.save();
+        return res.status(200).json({});
+      }
+      attempt.count++;
+      if (attempt.count >= 5) {
+        attempt.lockedUntil = Date.now() + 6e4;
+        attempt.count = 0;
+      }
+      mfaAttempts.set(sid, attempt);
+      res.status(401).json({ message: "invalid code" });
+    });
+    const getRpID = (req) => {
+      const origin = req.headers.origin;
+      if (origin) {
+        try {
+          return new URL(origin).hostname;
+        } catch {
+        }
+      }
+      return req.hostname;
+    };
+    openApi.get("/auth/webauthn/options", async (req, res) => {
+      const rpID = getRpID(req);
+      const options = await server$1.generateAuthenticationOptions({ rpID });
+      req.session.mfaChallenge = options.challenge;
+      req.session.save();
+      res.json(options);
+    });
+    openApi.post("/auth/webauthn/verify", async (req, res) => {
+      const challenge = req.session.mfaChallenge;
+      if (!challenge) {
+        return res.status(400).json({ message: "no pending challenge" });
+      }
+      delete req.session.mfaChallenge;
+      req.session.save();
+      try {
+        const { credential } = req.body;
+        const user = await this.database.findUserByPasskeyId(credential?.id);
+        if (!user || user.isBanned) {
+          return res.status(401).json({ message: "unknown credential" });
+        }
+        const passkey = user.passkeys.find((p) => p.id === credential.id);
+        const verification = await server$1.verifyAuthenticationResponse({
+          response: credential,
+          expectedChallenge: challenge,
+          expectedOrigin: req.headers.origin ?? `${req.protocol}://${req.get("host")}`,
+          expectedRPID: getRpID(req),
+          credential: {
+            id: passkey.id,
+            publicKey: Buffer.from(passkey.publicKey, "base64url"),
+            counter: passkey.counter,
+            transports: passkey.transports
+          }
+        });
+        if (!verification.verified) {
+          return res.status(401).json({ message: "verification failed" });
+        }
+        await this.database.updatePasskeyCounter(
+          user.username,
+          passkey.id,
+          verification.authenticationInfo.newCounter
+        );
+        req.session.userId = user._id;
+        delete req.session.mfaPending;
+        req.session.save();
+        res.status(200).json({});
+      } catch (e) {
+        res.status(400).json({ message: "verification error" });
+      }
+    });
     api.all("*", (req, _res, next) => {
       (async () => {
+        if (req.session.mfaPending) return next(new Error("unauthorized"));
         const user = await this.database.findUserById(req.session.userId);
         if (!user || user.isBanned) return next(new Error("unauthorized"));
         next();
@@ -158,6 +273,9 @@ class Webserver {
     );
     metrics.default(this);
     this.app.use(async (req, res) => {
+      if (req.session.mfaPending) {
+        return res.sendFile(path.join(PUBLIC_PATH, "auth.html"));
+      }
       const user = await this.database.findUserById(req.session.userId);
       const isAuth = user && !user.isBanned;
       if (isAuth) {

package/dist/webserver/backend/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../src/webserver/backend/index.ts"],"sourcesContent":["import Logger from '@/logger';\nimport soft from '@/softconfig';\nimport { IServerConfig } from '@config/types';\nimport type Omegga from '@omegga/server';\nimport { IServerStatus } from '@omegga/types';\nimport { createExpressMiddleware } from '@trpc/server/adapters/express';\nimport bodyParser from 'body-parser';\nimport express from 'express';\nimport expressSession from 'express-session';\nimport hasbin from 'hasbin';\nimport http from 'http';\nimport https from 'https';\nimport NedbStore from 'nedb-promises-session-store';\nimport path from 'path';\nimport Database from './database';\nimport setupMetrics from './metrics';\nimport { appRouter } from './router';\nimport { setWebserver } from './router/server';\nimport { createContext, setContextDeps } from './trpc';\nimport * as util from './util';\n\n// path to vite-built data\nconst PUBLIC_PATH = path.join(__dirname, '../../../public');\nconst ASSETS_PATH = path.join(__dirname, '../../../public/assets');\n\nconst log = (...args: any[]) => Logger.log(...args);\nconst error = (...args: any[]) => Logger.error(...args);\n\n// the webserver serves an authenticated web UI\nexport default class Webserver {\n  database: Database;\n  port: number;\n  omegga: Omegga;\n\n  app: express.Express;\n  server: http.Server | https.Server;\n\n  options: IServerConfig;\n  https: boolean;\n  started: boolean;\n  created: Promise<boolean>;\n\n  serverStatusInterval: ReturnType<typeof setInterval>;\n  lastReportedStatus: IServerStatus;\n\n  dataPath: string;\n\n  // create a webserver\n  constructor(options: IServerConfig, omegga: Omegga) {\n    this.port = Number(\n      options.port || process.env.OMEGGA_PORT || soft.DEFAULT_PORT,\n    );\n    this.options = options;\n    this.omegga = omegga;\n    this.dataPath = path.join(omegga.path, soft.DATA_PATH);\n\n    // the database provides omegga with metrics, chat logs, and more\n    // to help administrators keep track of their users and server\n    this.database = new Database(options, omegga);\n\n    // https status of the server\n    this.https = false;\n    // started status of the server\n    this.started = false;\n    this.created = this.createServer();\n  }\n\n  // create the webserver\n  async createServer() {\n    const hasOpenSSL = hasbin.sync('openssl');\n\n    // let the database do migrations\n    await this.database.doMigrations();\n\n    // create express app\n    this.app = express();\n\n    // create a server with https if applicable\n    const pickProtocol = async () => {\n      if (this.options.https) {\n        if (hasOpenSSL) {\n          const certFile = await util.getSSLKeys(this.dataPath);\n          if (certFile) {\n            // handy notification of generated ssl certs\n            if (certFile.new) log('>>'.green, 'Generated new SSL certificate');\n\n            this.https = true;\n            return https.createServer(\n              {\n                key: certFile.keys.serviceKey,\n                cert: certFile.keys.certificate,\n              },\n              this.app,\n            );\n          } else {\n            error(\n              '!>'.red,\n              'Error generating SSL certificate - falling back to http',\n            );\n          }\n        }\n\n        // warn the user\n        log(\n          ':>'.yellow,\n          'Running web server with http - install',\n          'openssl'.yellow.underline,\n          'for https (more secure)',\n        );\n      }\n\n      // fallback to http\n      return new http.Server(this.app);\n    };\n\n    // create http(s) server based on openssl availability\n    this.server = await pickProtocol();\n\n    this.app.set('trust proxy', 1);\n    const session = expressSession({\n      secret: util.getSessionSecret(this.dataPath),\n      resave: false,\n      saveUninitialized: false,\n      cookie: {\n        path: '/',\n        secure: this.https,\n        maxAge: 365 * 24 * 60 * 60 * 1000, // 1 year\n      },\n      // use a nedb database for session store\n      // For some reason vite is not importing the default export properly without this...\n      store: (NedbStore['default'] as typeof NedbStore)({\n        filename: path.join(this.dataPath, soft.SESSION_STORE),\n        connect: expressSession,\n      }),\n    });\n    this.app.use(session);\n\n    // setup routes and webserver\n    await this.initWebUI();\n    return true;\n  }\n\n  // setup the web ui routes\n  async initWebUI() {\n    await this.database.getInstanceId();\n\n    // Initialize tRPC context deps\n    setContextDeps({\n      database: this.database,\n      omegga: this.omegga,\n    });\n    setWebserver(this);\n\n    // provide assets in the /public path\n    this.app.use('/assets', express.static(ASSETS_PATH));\n    this.app.use(bodyParser.json());\n\n    // --- Auth routes (outside tRPC) ---\n    const openApi = express.Router();\n    const api = express.Router();\n\n    // check if this is the first user in the database\n    openApi.get('/first', async (req, res) =>\n      res.json(await this.database.isFirstUser()),\n    );\n\n    // login / create admin user route\n    openApi.post('/auth', async (req, res) => {\n      if (\n        typeof req.body !== 'object' ||\n        typeof req.body.username !== 'string' ||\n        typeof req.body.password !== 'string'\n      ) {\n        return res.status(422).json({ message: 'invalid body' });\n      }\n      const { username, password } = req.body;\n\n      if (!username.match(/^\\w{0,32}$/)) {\n        return res.status(422).json({ message: 'invalid body' });\n      }\n\n      const isFirst = await this.database.isFirstUser();\n      let user;\n      if (isFirst) {\n        user = await this.database.createAdminUser(\n          username,\n          username === '' ? '' : password,\n        );\n      } else {\n        user = await this.database.authUser(username, password);\n      }\n\n      if (user) {\n        req.session.userId = user._id;\n        req.session.save();\n        res.status(200).json({});\n      } else {\n        res.status(404).json({ message: 'no user found' });\n      }\n    });\n\n    // authentication middleware for protected api routes\n    api.all('*', (req, _res, next) => {\n      (async () => {\n        const user = await this.database.findUserById(req.session.userId);\n        if (!user || user.isBanned) return next(new Error('unauthorized'));\n        next();\n      })();\n    });\n\n    // kill a session\n    api.get('/logout', (req, res) => {\n      req.session.destroy(e => {\n        res.status(e ? 500 : 200).json({});\n      });\n    });\n\n    this.app.use('/api/v1', openApi);\n    this.app.use('/api/v1', api);\n\n    // --- tRPC ---\n    this.app.use(\n      '/trpc',\n      createExpressMiddleware({\n        router: appRouter,\n        createContext,\n      }),\n    );\n\n    // setup metrics and tracking\n    setupMetrics(this);\n\n    // every request goes through the index file (frontend handles 404s)\n    this.app.use(async (req, res) => {\n      const user = await this.database.findUserById(req.session.userId);\n      const isAuth = user && !user.isBanned;\n      if (isAuth) {\n        res.sendFile(path.join(PUBLIC_PATH, 'app.html'));\n      } else {\n        res.sendFile(path.join(PUBLIC_PATH, 'auth.html'));\n      }\n    });\n  }\n\n  // start the webserver\n  async start() {\n    if (this.started) return;\n    await this.created;\n    return await new Promise<void>(resolve => {\n      this.server.listen(this.port, () => {\n        log(\n          `${'>>'.green} Web UI available at`,\n          `http${this.https ? 's' : ''}://127.0.0.1:${this.port}`.green,\n        );\n        this.started = true;\n        this.database.addChatLog('server', {}, 'Server started');\n        resolve();\n      });\n    });\n  }\n\n  // stop the webserver\n  stop() {\n    this.database.addChatLog('server', {}, 'Server stopped');\n    this.server.close();\n    this.started = false;\n    clearInterval(this.serverStatusInterval);\n  }\n}\n"],"names":["Logger","soft","Database","util.getSSLKeys","util.getSessionSecret","setContextDeps","setWebserver","createExpressMiddleware","appRouter","createContext","setupMetrics"],"mappings":";;;;;;;;;;;;;;;;;;;AAsBA,MAAM,cAAc,KAAK,KAAK,WAAW,iBAAiB;AAC1D,MAAM,cAAc,KAAK,KAAK,WAAW,wBAAwB;AAEjE,MAAM,MAAM,IAAI,SAAgBA,OAAAA,QAAO,IAAI,GAAG,IAAI;AAClD,MAAM,QAAQ,IAAI,SAAgBA,OAAAA,QAAO,MAAM,GAAG,IAAI;AAGtD,MAAqB,UAAU;AAAA;AAAA,EAmB7B,YAAY,SAAwB,QAAgB;AAClD,SAAK,OAAO;AAAA,MACV,QAAQ,QAAQ,QAAQ,IAAI,eAAeC,WAAAA,QAAK;AAAA,IAAA;AAElD,SAAK,UAAU;AACf,SAAK,SAAS;AACd,SAAK,WAAW,KAAK,KAAK,OAAO,MAAMA,WAAAA,QAAK,SAAS;AAIrD,SAAK,WAAW,IAAIC,iBAAS,SAAS,MAAM;AAG5C,SAAK,QAAQ;AAEb,SAAK,UAAU;AACf,SAAK,UAAU,KAAK,aAAA;AAAA,EACtB;AAAA;AAAA,EAGA,MAAM,eAAe;AACnB,UAAM,aAAa,OAAO,KAAK,SAAS;AAGxC,UAAM,KAAK,SAAS,aAAA;AAGpB,SAAK,MAAM,QAAA;AAGX,UAAM,eAAe,YAAY;AAC/B,UAAI,KAAK,QAAQ,OAAO;AACtB,YAAI,YAAY;AACd,gBAAM,WAAW,MAAMC,gBAAgB,KAAK,QAAQ;AACpD,cAAI,UAAU;AAEZ,gBAAI,SAAS,IAAK,KAAI,KAAK,OAAO,+BAA+B;AAEjE,iBAAK,QAAQ;AACb,mBAAO,MAAM;AAAA,cACX;AAAA,gBACE,KAAK,SAAS,KAAK;AAAA,gBACnB,MAAM,SAAS,KAAK;AAAA,cAAA;AAAA,cAEtB,KAAK;AAAA,YAAA;AAAA,UAET,OAAO;AACL;AAAA,cACE,KAAK;AAAA,cACL;AAAA,YAAA;AAAA,UAEJ;AAAA,QACF;AAGA;AAAA,UACE,KAAK;AAAA,UACL;AAAA,UACA,UAAU,OAAO;AAAA,UACjB;AAAA,QAAA;AAAA,MAEJ;AAGA,aAAO,IAAI,KAAK,OAAO,KAAK,GAAG;AAAA,IACjC;AAGA,SAAK,SAAS,MAAM,aAAA;AAEpB,SAAK,IAAI,IAAI,eAAe,CAAC;AAC7B,UAAM,UAAU,eAAe;AAAA,MAC7B,QAAQC,KAAAA,iBAAsB,KAAK,QAAQ;AAAA,MAC3C,QAAQ;AAAA,MACR,mBAAmB;AAAA,MACnB,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,QAAQ,KAAK;AAAA,QACb,QAAQ,MAAM,KAAK,KAAK,KAAK;AAAA;AAAA,MAAA;AAAA;AAAA;AAAA,MAI/B,OAAQ,UAAU,SAAS,EAAuB;AAAA,QAChD,UAAU,KAAK,KAAK,KAAK,UAAUH,WAAAA,QAAK,aAAa;AAAA,QACrD,SAAS;AAAA,MAAA,CACV;AAAA,IAAA,CACF;AACD,SAAK,IAAI,IAAI,OAAO;AAGpB,UAAM,KAAK,UAAA;AACX,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,YAAY;AAChB,UAAM,KAAK,SAAS,cAAA;AAGpBI,wBAAe;AAAA,MACb,UAAU,KAAK;AAAA,MACf,QAAQ,KAAK;AAAA,IAAA,CACd;AACDC,WAAAA,aAAa,IAAI;AAGjB,SAAK,IAAI,IAAI,WAAW,QAAQ,OAAO,WAAW,CAAC;AACnD,SAAK,IAAI,IAAI,WAAW,KAAA,CAAM;AAG9B,UAAM,UAAU,QAAQ,OAAA;AACxB,UAAM,MAAM,QAAQ,OAAA;AAGpB,YAAQ;AAAA,MAAI;AAAA,MAAU,OAAO,KAAK,QAChC,IAAI,KAAK,MAAM,KAAK,SAAS,YAAA,CAAa;AAAA,IAAA;AAI5C,YAAQ,KAAK,SAAS,OAAO,KAAK,QAAQ;AACxC,UACE,OAAO,IAAI,SAAS,YACpB,OAAO,IAAI,KAAK,aAAa,YAC7B,OAAO,IAAI,KAAK,aAAa,UAC7B;AACA,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,gBAAgB;AAAA,MACzD;AACA,YAAM,EAAE,UAAU,SAAA,IAAa,IAAI;AAEnC,UAAI,CAAC,SAAS,MAAM,YAAY,GAAG;AACjC,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,gBAAgB;AAAA,MACzD;AAEA,YAAM,UAAU,MAAM,KAAK,SAAS,YAAA;AACpC,UAAI;AACJ,UAAI,SAAS;AACX,eAAO,MAAM,KAAK,SAAS;AAAA,UACzB;AAAA,UACA,aAAa,KAAK,KAAK;AAAA,QAAA;AAAA,MAE3B,OAAO;AACL,eAAO,MAAM,KAAK,SAAS,SAAS,UAAU,QAAQ;AAAA,MACxD;AAEA,UAAI,MAAM;AACR,YAAI,QAAQ,SAAS,KAAK;AAC1B,YAAI,QAAQ,KAAA;AACZ,YAAI,OAAO,GAAG,EAAE,KAAK,CAAA,CAAE;AAAA,MACzB,OAAO;AACL,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,iBAAiB;AAAA,MACnD;AAAA,IACF,CAAC;AAGD,QAAI,IAAI,KAAK,CAAC,KAAK,MAAM,SAAS;AAChC,OAAC,YAAY;AACX,cAAM,OAAO,MAAM,KAAK,SAAS,aAAa,IAAI,QAAQ,MAAM;AAChE,YAAI,CAAC,QAAQ,KAAK,iBAAiB,KAAK,IAAI,MAAM,cAAc,CAAC;AACjE,aAAA;AAAA,MACF,GAAA;AAAA,IACF,CAAC;AAGD,QAAI,IAAI,WAAW,CAAC,KAAK,QAAQ;AAC/B,UAAI,QAAQ,QAAQ,CAAA,MAAK;AACvB,YAAI,OAAO,IAAI,MAAM,GAAG,EAAE,KAAK,EAAE;AAAA,MACnC,CAAC;AAAA,IACH,CAAC;AAED,SAAK,IAAI,IAAI,WAAW,OAAO;AAC/B,SAAK,IAAI,IAAI,WAAW,GAAG;AAG3B,SAAK,IAAI;AAAA,MACP;AAAA,MACAC,kCAAwB;AAAA,QACtB,QAAQC,MAAAA;AAAAA,QAAA,eACRC,KAAAA;AAAAA,MAAA,CACD;AAAA,IAAA;AAIHC,YAAAA,QAAa,IAAI;AAGjB,SAAK,IAAI,IAAI,OAAO,KAAK,QAAQ;AAC/B,YAAM,OAAO,MAAM,KAAK,SAAS,aAAa,IAAI,QAAQ,MAAM;AAChE,YAAM,SAAS,QAAQ,CAAC,KAAK;AAC7B,UAAI,QAAQ;AACV,YAAI,SAAS,KAAK,KAAK,aAAa,UAAU,CAAC;AAAA,MACjD,OAAO;AACL,YAAI,SAAS,KAAK,KAAK,aAAa,WAAW,CAAC;AAAA,MAClD;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,QAAQ;AACZ,QAAI,KAAK,QAAS;AAClB,UAAM,KAAK;AACX,WAAO,MAAM,IAAI,QAAc,CAAA,YAAW;AACxC,WAAK,OAAO,OAAO,KAAK,MAAM,MAAM;AAClC;AAAA,UACE,GAAG,KAAK,KAAK;AAAA,UACb,OAAO,KAAK,QAAQ,MAAM,EAAE,gBAAgB,KAAK,IAAI,GAAG;AAAA,QAAA;AAE1D,aAAK,UAAU;AACf,aAAK,SAAS,WAAW,UAAU,CAAA,GAAI,gBAAgB;AACvD,gBAAA;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,OAAO;AACL,SAAK,SAAS,WAAW,UAAU,CAAA,GAAI,gBAAgB;AACvD,SAAK,OAAO,MAAA;AACZ,SAAK,UAAU;AACf,kBAAc,KAAK,oBAAoB;AAAA,EACzC;AACF;;"}
+{"version":3,"file":"index.js","sources":["../../../src/webserver/backend/index.ts"],"sourcesContent":["import Logger from '@/logger';\nimport soft from '@/softconfig';\nimport { IServerConfig } from '@config/types';\nimport type Omegga from '@omegga/server';\nimport { IServerStatus } from '@omegga/types';\nimport { createExpressMiddleware } from '@trpc/server/adapters/express';\nimport bodyParser from 'body-parser';\nimport express from 'express';\nimport expressSession from 'express-session';\nimport hasbin from 'hasbin';\nimport http from 'http';\nimport https from 'https';\nimport NedbStore from 'nedb-promises-session-store';\nimport path from 'path';\nimport bcrypt from 'bcryptjs';\nimport {\n  generateAuthenticationOptions,\n  verifyAuthenticationResponse,\n} from '@simplewebauthn/server';\nimport Database from './database';\nimport { verifyToken as verifyTOTP } from './totp';\nimport setupMetrics from './metrics';\nimport { appRouter } from './router';\nimport { setWebserver } from './router/server';\nimport { createContext, setContextDeps } from './trpc';\nimport * as util from './util';\n\n// path to vite-built data\nconst PUBLIC_PATH = path.join(__dirname, '../../../public');\nconst ASSETS_PATH = path.join(__dirname, '../../../public/assets');\n\nconst log = (...args: any[]) => Logger.log(...args);\nconst error = (...args: any[]) => Logger.error(...args);\n\n// the webserver serves an authenticated web UI\nexport default class Webserver {\n  database: Database;\n  port: number;\n  omegga: Omegga;\n\n  app: express.Express;\n  server: http.Server | https.Server;\n\n  options: IServerConfig;\n  https: boolean;\n  started: boolean;\n  created: Promise<boolean>;\n\n  serverStatusInterval: ReturnType<typeof setInterval>;\n  lastReportedStatus: IServerStatus | null = null;\n\n  dataPath: string;\n\n  // create a webserver\n  constructor(options: IServerConfig, omegga: Omegga) {\n    this.port = Number(\n      options.port || process.env.OMEGGA_PORT || soft.DEFAULT_PORT,\n    );\n    this.options = options;\n    this.omegga = omegga;\n    this.dataPath = path.join(omegga.path, soft.DATA_PATH);\n\n    // the database provides omegga with metrics, chat logs, and more\n    // to help administrators keep track of their users and server\n    this.database = new Database(options, omegga);\n\n    // https status of the server\n    this.https = false;\n    // started status of the server\n    this.started = false;\n    this.created = this.createServer();\n  }\n\n  // create the webserver\n  async createServer() {\n    const hasOpenSSL = hasbin.sync('openssl');\n\n    // let the database do migrations\n    await this.database.doMigrations();\n\n    // create express app\n    this.app = express();\n\n    // create a server with https if applicable\n    const pickProtocol = async () => {\n      if (this.options.https) {\n        if (hasOpenSSL) {\n          const certFile = await util.getSSLKeys(this.dataPath);\n          if (certFile) {\n            // handy notification of generated ssl certs\n            if (certFile.new) log('>>'.green, 'Generated new SSL certificate');\n\n            this.https = true;\n            return https.createServer(\n              {\n                key: certFile.keys.serviceKey,\n                cert: certFile.keys.certificate,\n              },\n              this.app,\n            );\n          } else {\n            error(\n              '!>'.red,\n              'Error generating SSL certificate - falling back to http',\n            );\n          }\n        }\n\n        // warn the user\n        log(\n          ':>'.yellow,\n          'Running web server with http - install',\n          'openssl'.yellow.underline,\n          'for https (more secure)',\n        );\n      }\n\n      // fallback to http\n      return new http.Server(this.app);\n    };\n\n    // create http(s) server based on openssl availability\n    this.server = await pickProtocol();\n\n    this.app.set('trust proxy', 1);\n    const session = expressSession({\n      secret: util.getSessionSecret(this.dataPath),\n      resave: false,\n      saveUninitialized: false,\n      cookie: {\n        path: '/',\n        secure: this.https,\n        maxAge: 365 * 24 * 60 * 60 * 1000, // 1 year\n      },\n      // use a nedb database for session store\n      // For some reason vite is not importing the default export properly without this...\n      store: (NedbStore['default'] as typeof NedbStore)({\n        filename: path.join(this.dataPath, soft.SESSION_STORE),\n        connect: expressSession,\n      }),\n    });\n    this.app.use(session);\n\n    // setup routes and webserver\n    await this.initWebUI();\n    return true;\n  }\n\n  // setup the web ui routes\n  async initWebUI() {\n    await this.database.getInstanceId();\n\n    // Initialize tRPC context deps\n    setContextDeps({\n      database: this.database,\n      omegga: this.omegga,\n    });\n    setWebserver(this);\n\n    // provide assets in the /public path\n    this.app.use('/assets', express.static(ASSETS_PATH));\n    this.app.use(bodyParser.json());\n\n    // --- Auth routes (outside tRPC) ---\n    const openApi = express.Router();\n    const api = express.Router();\n\n    // check if this is the first user in the database\n    openApi.get('/first', async (req, res) =>\n      res.json(await this.database.isFirstUser()),\n    );\n\n    // login / create admin user route\n    openApi.post('/auth', async (req, res) => {\n      if (\n        typeof req.body !== 'object' ||\n        typeof req.body.username !== 'string' ||\n        typeof req.body.password !== 'string'\n      ) {\n        return res.status(422).json({ message: 'invalid body' });\n      }\n      const { username, password } = req.body;\n\n      if (!username.match(/^\\w{0,32}$/)) {\n        return res.status(422).json({ message: 'invalid body' });\n      }\n\n      const isFirst = await this.database.isFirstUser();\n      let user;\n      if (isFirst) {\n        user = await this.database.createAdminUser(\n          username,\n          username === '' ? '' : password,\n        );\n      } else {\n        user = await this.database.authUser(username, password);\n      }\n\n      if (user) {\n        req.session.userId = user._id;\n        if (user.totpEnabled) {\n          req.session.mfaPending = true;\n          req.session.save();\n          res.status(200).json({ mfaRequired: true });\n        } else {\n          req.session.save();\n          res.status(200).json({});\n        }\n      } else {\n        res.status(404).json({ message: 'no user found' });\n      }\n    });\n\n    // rate limiting for MFA verification (per session)\n    const mfaAttempts = new Map<\n      string,\n      { count: number; lockedUntil: number }\n    >();\n\n    // TOTP verification during MFA challenge\n    openApi.post('/auth/mfa/totp', async (req, res) => {\n      if (!req.session.mfaPending || !req.session.userId) {\n        return res.status(400).json({ message: 'no pending MFA challenge' });\n      }\n\n      // rate limit: 5 attempts, then 60s lockout\n      const sid = req.sessionID;\n      const attempt = mfaAttempts.get(sid) ?? { count: 0, lockedUntil: 0 };\n      if (Date.now() < attempt.lockedUntil) {\n        return res\n          .status(429)\n          .json({ message: 'too many attempts, try again later' });\n      }\n\n      const { code } = req.body ?? {};\n      if (typeof code !== 'string') {\n        return res.status(422).json({ message: 'code required' });\n      }\n      const user = await this.database.findUserById(req.session.userId);\n      if (!user || !user.totpSecret) {\n        return res.status(400).json({ message: 'MFA not configured' });\n      }\n\n      let verified = false;\n\n      if (verifyTOTP(code, user.totpSecret)) {\n        verified = true;\n      }\n\n      // try recovery codes\n      if (!verified && user.recoveryCodes?.length) {\n        for (const hashedCode of user.recoveryCodes) {\n          if (await bcrypt.compare(code, hashedCode)) {\n            await this.database.removeRecoveryCode(user.username, hashedCode);\n            verified = true;\n            break;\n          }\n        }\n      }\n\n      if (verified) {\n        mfaAttempts.delete(sid);\n        delete req.session.mfaPending;\n        req.session.save();\n        return res.status(200).json({});\n      }\n\n      attempt.count++;\n      if (attempt.count >= 5) {\n        attempt.lockedUntil = Date.now() + 60_000;\n        attempt.count = 0;\n      }\n      mfaAttempts.set(sid, attempt);\n      res.status(401).json({ message: 'invalid code' });\n    });\n\n    const getRpID = (req: express.Request) => {\n      const origin = req.headers.origin;\n      if (origin) {\n        try {\n          return new URL(origin as string).hostname;\n        } catch {}\n      }\n      return req.hostname;\n    };\n\n    // WebAuthn authentication options (passwordless login)\n    openApi.get('/auth/webauthn/options', async (req, res) => {\n      const rpID = getRpID(req);\n      const options = await generateAuthenticationOptions({ rpID });\n      req.session.mfaChallenge = options.challenge;\n      req.session.save();\n      res.json(options);\n    });\n\n    // WebAuthn authentication verification\n    openApi.post('/auth/webauthn/verify', async (req, res) => {\n      const challenge = req.session.mfaChallenge;\n      if (!challenge) {\n        return res.status(400).json({ message: 'no pending challenge' });\n      }\n      // clear challenge immediately to prevent replay\n      delete req.session.mfaChallenge;\n      req.session.save();\n      try {\n        const { credential } = req.body;\n        const user = await this.database.findUserByPasskeyId(credential?.id);\n        if (!user || user.isBanned) {\n          return res.status(401).json({ message: 'unknown credential' });\n        }\n        const passkey = user.passkeys!.find(p => p.id === credential.id)!;\n        const verification = await verifyAuthenticationResponse({\n          response: credential,\n          expectedChallenge: challenge,\n          expectedOrigin:\n            req.headers.origin ?? `${req.protocol}://${req.get('host')}`,\n          expectedRPID: getRpID(req),\n          credential: {\n            id: passkey.id,\n            publicKey: Buffer.from(passkey.publicKey, 'base64url'),\n            counter: passkey.counter,\n            transports: passkey.transports as any,\n          },\n        });\n        if (!verification.verified) {\n          return res.status(401).json({ message: 'verification failed' });\n        }\n        await this.database.updatePasskeyCounter(\n          user.username,\n          passkey.id,\n          verification.authenticationInfo.newCounter,\n        );\n        req.session.userId = (user as any)._id;\n        delete req.session.mfaPending;\n        req.session.save();\n        res.status(200).json({});\n      } catch (e) {\n        res.status(400).json({ message: 'verification error' });\n      }\n    });\n\n    // authentication middleware for protected api routes\n    api.all('*', (req, _res, next) => {\n      (async () => {\n        if (req.session.mfaPending) return next(new Error('unauthorized'));\n        const user = await this.database.findUserById(req.session.userId);\n        if (!user || user.isBanned) return next(new Error('unauthorized'));\n        next();\n      })();\n    });\n\n    // kill a session\n    api.get('/logout', (req, res) => {\n      req.session.destroy(e => {\n        res.status(e ? 500 : 200).json({});\n      });\n    });\n\n    this.app.use('/api/v1', openApi);\n    this.app.use('/api/v1', api);\n\n    // --- tRPC ---\n    this.app.use(\n      '/trpc',\n      createExpressMiddleware({\n        router: appRouter,\n        createContext,\n      }),\n    );\n\n    // setup metrics and tracking\n    setupMetrics(this);\n\n    // every request goes through the index file (frontend handles 404s)\n    this.app.use(async (req, res) => {\n      if (req.session.mfaPending) {\n        return res.sendFile(path.join(PUBLIC_PATH, 'auth.html'));\n      }\n      const user = await this.database.findUserById(req.session.userId);\n      const isAuth = user && !user.isBanned;\n      if (isAuth) {\n        res.sendFile(path.join(PUBLIC_PATH, 'app.html'));\n      } else {\n        res.sendFile(path.join(PUBLIC_PATH, 'auth.html'));\n      }\n    });\n  }\n\n  // start the webserver\n  async start() {\n    if (this.started) return;\n    await this.created;\n    return await new Promise<void>(resolve => {\n      this.server.listen(this.port, () => {\n        log(\n          `${'>>'.green} Web UI available at`,\n          `http${this.https ? 's' : ''}://127.0.0.1:${this.port}`.green,\n        );\n        this.started = true;\n        this.database.addChatLog('server', {}, 'Server started');\n        resolve();\n      });\n    });\n  }\n\n  // stop the webserver\n  stop() {\n    this.database.addChatLog('server', {}, 'Server stopped');\n    this.server.close();\n    this.started = false;\n    clearInterval(this.serverStatusInterval);\n  }\n}\n"],"names":["Logger","soft","Database","util.getSSLKeys","util.getSessionSecret","setContextDeps","setWebserver","verifyTOTP","generateAuthenticationOptions","verifyAuthenticationResponse","createExpressMiddleware","appRouter","createContext","setupMetrics"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,cAAc,KAAK,KAAK,WAAW,iBAAiB;AAC1D,MAAM,cAAc,KAAK,KAAK,WAAW,wBAAwB;AAEjE,MAAM,MAAM,IAAI,SAAgBA,OAAAA,QAAO,IAAI,GAAG,IAAI;AAClD,MAAM,QAAQ,IAAI,SAAgBA,OAAAA,QAAO,MAAM,GAAG,IAAI;AAGtD,MAAqB,UAAU;AAAA;AAAA,EAmB7B,YAAY,SAAwB,QAAgB;AALpD,SAAA,qBAA2C;AAMzC,SAAK,OAAO;AAAA,MACV,QAAQ,QAAQ,QAAQ,IAAI,eAAeC,WAAAA,QAAK;AAAA,IAAA;AAElD,SAAK,UAAU;AACf,SAAK,SAAS;AACd,SAAK,WAAW,KAAK,KAAK,OAAO,MAAMA,WAAAA,QAAK,SAAS;AAIrD,SAAK,WAAW,IAAIC,iBAAS,SAAS,MAAM;AAG5C,SAAK,QAAQ;AAEb,SAAK,UAAU;AACf,SAAK,UAAU,KAAK,aAAA;AAAA,EACtB;AAAA;AAAA,EAGA,MAAM,eAAe;AACnB,UAAM,aAAa,OAAO,KAAK,SAAS;AAGxC,UAAM,KAAK,SAAS,aAAA;AAGpB,SAAK,MAAM,QAAA;AAGX,UAAM,eAAe,YAAY;AAC/B,UAAI,KAAK,QAAQ,OAAO;AACtB,YAAI,YAAY;AACd,gBAAM,WAAW,MAAMC,gBAAgB,KAAK,QAAQ;AACpD,cAAI,UAAU;AAEZ,gBAAI,SAAS,IAAK,KAAI,KAAK,OAAO,+BAA+B;AAEjE,iBAAK,QAAQ;AACb,mBAAO,MAAM;AAAA,cACX;AAAA,gBACE,KAAK,SAAS,KAAK;AAAA,gBACnB,MAAM,SAAS,KAAK;AAAA,cAAA;AAAA,cAEtB,KAAK;AAAA,YAAA;AAAA,UAET,OAAO;AACL;AAAA,cACE,KAAK;AAAA,cACL;AAAA,YAAA;AAAA,UAEJ;AAAA,QACF;AAGA;AAAA,UACE,KAAK;AAAA,UACL;AAAA,UACA,UAAU,OAAO;AAAA,UACjB;AAAA,QAAA;AAAA,MAEJ;AAGA,aAAO,IAAI,KAAK,OAAO,KAAK,GAAG;AAAA,IACjC;AAGA,SAAK,SAAS,MAAM,aAAA;AAEpB,SAAK,IAAI,IAAI,eAAe,CAAC;AAC7B,UAAM,UAAU,eAAe;AAAA,MAC7B,QAAQC,KAAAA,iBAAsB,KAAK,QAAQ;AAAA,MAC3C,QAAQ;AAAA,MACR,mBAAmB;AAAA,MACnB,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,QAAQ,KAAK;AAAA,QACb,QAAQ,MAAM,KAAK,KAAK,KAAK;AAAA;AAAA,MAAA;AAAA;AAAA;AAAA,MAI/B,OAAQ,UAAU,SAAS,EAAuB;AAAA,QAChD,UAAU,KAAK,KAAK,KAAK,UAAUH,WAAAA,QAAK,aAAa;AAAA,QACrD,SAAS;AAAA,MAAA,CACV;AAAA,IAAA,CACF;AACD,SAAK,IAAI,IAAI,OAAO;AAGpB,UAAM,KAAK,UAAA;AACX,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,YAAY;AAChB,UAAM,KAAK,SAAS,cAAA;AAGpBI,wBAAe;AAAA,MACb,UAAU,KAAK;AAAA,MACf,QAAQ,KAAK;AAAA,IAAA,CACd;AACDC,WAAAA,aAAa,IAAI;AAGjB,SAAK,IAAI,IAAI,WAAW,QAAQ,OAAO,WAAW,CAAC;AACnD,SAAK,IAAI,IAAI,WAAW,KAAA,CAAM;AAG9B,UAAM,UAAU,QAAQ,OAAA;AACxB,UAAM,MAAM,QAAQ,OAAA;AAGpB,YAAQ;AAAA,MAAI;AAAA,MAAU,OAAO,KAAK,QAChC,IAAI,KAAK,MAAM,KAAK,SAAS,YAAA,CAAa;AAAA,IAAA;AAI5C,YAAQ,KAAK,SAAS,OAAO,KAAK,QAAQ;AACxC,UACE,OAAO,IAAI,SAAS,YACpB,OAAO,IAAI,KAAK,aAAa,YAC7B,OAAO,IAAI,KAAK,aAAa,UAC7B;AACA,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,gBAAgB;AAAA,MACzD;AACA,YAAM,EAAE,UAAU,SAAA,IAAa,IAAI;AAEnC,UAAI,CAAC,SAAS,MAAM,YAAY,GAAG;AACjC,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,gBAAgB;AAAA,MACzD;AAEA,YAAM,UAAU,MAAM,KAAK,SAAS,YAAA;AACpC,UAAI;AACJ,UAAI,SAAS;AACX,eAAO,MAAM,KAAK,SAAS;AAAA,UACzB;AAAA,UACA,aAAa,KAAK,KAAK;AAAA,QAAA;AAAA,MAE3B,OAAO;AACL,eAAO,MAAM,KAAK,SAAS,SAAS,UAAU,QAAQ;AAAA,MACxD;AAEA,UAAI,MAAM;AACR,YAAI,QAAQ,SAAS,KAAK;AAC1B,YAAI,KAAK,aAAa;AACpB,cAAI,QAAQ,aAAa;AACzB,cAAI,QAAQ,KAAA;AACZ,cAAI,OAAO,GAAG,EAAE,KAAK,EAAE,aAAa,MAAM;AAAA,QAC5C,OAAO;AACL,cAAI,QAAQ,KAAA;AACZ,cAAI,OAAO,GAAG,EAAE,KAAK,CAAA,CAAE;AAAA,QACzB;AAAA,MACF,OAAO;AACL,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,iBAAiB;AAAA,MACnD;AAAA,IACF,CAAC;AAGD,UAAM,kCAAkB,IAAA;AAMxB,YAAQ,KAAK,kBAAkB,OAAO,KAAK,QAAQ;AACjD,UAAI,CAAC,IAAI,QAAQ,cAAc,CAAC,IAAI,QAAQ,QAAQ;AAClD,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,4BAA4B;AAAA,MACrE;AAGA,YAAM,MAAM,IAAI;AAChB,YAAM,UAAU,YAAY,IAAI,GAAG,KAAK,EAAE,OAAO,GAAG,aAAa,EAAA;AACjE,UAAI,KAAK,QAAQ,QAAQ,aAAa;AACpC,eAAO,IACJ,OAAO,GAAG,EACV,KAAK,EAAE,SAAS,sCAAsC;AAAA,MAC3D;AAEA,YAAM,EAAE,KAAA,IAAS,IAAI,QAAQ,CAAA;AAC7B,UAAI,OAAO,SAAS,UAAU;AAC5B,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,iBAAiB;AAAA,MAC1D;AACA,YAAM,OAAO,MAAM,KAAK,SAAS,aAAa,IAAI,QAAQ,MAAM;AAChE,UAAI,CAAC,QAAQ,CAAC,KAAK,YAAY;AAC7B,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,sBAAsB;AAAA,MAC/D;AAEA,UAAI,WAAW;AAEf,UAAIC,iBAAW,MAAM,KAAK,UAAU,GAAG;AACrC,mBAAW;AAAA,MACb;AAGA,UAAI,CAAC,YAAY,KAAK,eAAe,QAAQ;AAC3C,mBAAW,cAAc,KAAK,eAAe;AAC3C,cAAI,MAAM,OAAO,QAAQ,MAAM,UAAU,GAAG;AAC1C,kBAAM,KAAK,SAAS,mBAAmB,KAAK,UAAU,UAAU;AAChE,uBAAW;AACX;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,UAAI,UAAU;AACZ,oBAAY,OAAO,GAAG;AACtB,eAAO,IAAI,QAAQ;AACnB,YAAI,QAAQ,KAAA;AACZ,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,CAAA,CAAE;AAAA,MAChC;AAEA,cAAQ;AACR,UAAI,QAAQ,SAAS,GAAG;AACtB,gBAAQ,cAAc,KAAK,IAAA,IAAQ;AACnC,gBAAQ,QAAQ;AAAA,MAClB;AACA,kBAAY,IAAI,KAAK,OAAO;AAC5B,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,gBAAgB;AAAA,IAClD,CAAC;AAED,UAAM,UAAU,CAAC,QAAyB;AACxC,YAAM,SAAS,IAAI,QAAQ;AAC3B,UAAI,QAAQ;AACV,YAAI;AACF,iBAAO,IAAI,IAAI,MAAgB,EAAE;AAAA,QACnC,QAAQ;AAAA,QAAC;AAAA,MACX;AACA,aAAO,IAAI;AAAA,IACb;AAGA,YAAQ,IAAI,0BAA0B,OAAO,KAAK,QAAQ;AACxD,YAAM,OAAO,QAAQ,GAAG;AACxB,YAAM,UAAU,MAAMC,uCAA8B,EAAE,MAAM;AAC5D,UAAI,QAAQ,eAAe,QAAQ;AACnC,UAAI,QAAQ,KAAA;AACZ,UAAI,KAAK,OAAO;AAAA,IAClB,CAAC;AAGD,YAAQ,KAAK,yBAAyB,OAAO,KAAK,QAAQ;AACxD,YAAM,YAAY,IAAI,QAAQ;AAC9B,UAAI,CAAC,WAAW;AACd,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,wBAAwB;AAAA,MACjE;AAEA,aAAO,IAAI,QAAQ;AACnB,UAAI,QAAQ,KAAA;AACZ,UAAI;AACF,cAAM,EAAE,eAAe,IAAI;AAC3B,cAAM,OAAO,MAAM,KAAK,SAAS,oBAAoB,YAAY,EAAE;AACnE,YAAI,CAAC,QAAQ,KAAK,UAAU;AAC1B,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,sBAAsB;AAAA,QAC/D;AACA,cAAM,UAAU,KAAK,SAAU,KAAK,OAAK,EAAE,OAAO,WAAW,EAAE;AAC/D,cAAM,eAAe,MAAMC,sCAA6B;AAAA,UACtD,UAAU;AAAA,UACV,mBAAmB;AAAA,UACnB,gBACE,IAAI,QAAQ,UAAU,GAAG,IAAI,QAAQ,MAAM,IAAI,IAAI,MAAM,CAAC;AAAA,UAC5D,cAAc,QAAQ,GAAG;AAAA,UACzB,YAAY;AAAA,YACV,IAAI,QAAQ;AAAA,YACZ,WAAW,OAAO,KAAK,QAAQ,WAAW,WAAW;AAAA,YACrD,SAAS,QAAQ;AAAA,YACjB,YAAY,QAAQ;AAAA,UAAA;AAAA,QACtB,CACD;AACD,YAAI,CAAC,aAAa,UAAU;AAC1B,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,uBAAuB;AAAA,QAChE;AACA,cAAM,KAAK,SAAS;AAAA,UAClB,KAAK;AAAA,UACL,QAAQ;AAAA,UACR,aAAa,mBAAmB;AAAA,QAAA;AAElC,YAAI,QAAQ,SAAU,KAAa;AACnC,eAAO,IAAI,QAAQ;AACnB,YAAI,QAAQ,KAAA;AACZ,YAAI,OAAO,GAAG,EAAE,KAAK,CAAA,CAAE;AAAA,MACzB,SAAS,GAAG;AACV,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,sBAAsB;AAAA,MACxD;AAAA,IACF,CAAC;AAGD,QAAI,IAAI,KAAK,CAAC,KAAK,MAAM,SAAS;AAChC,OAAC,YAAY;AACX,YAAI,IAAI,QAAQ,WAAY,QAAO,KAAK,IAAI,MAAM,cAAc,CAAC;AACjE,cAAM,OAAO,MAAM,KAAK,SAAS,aAAa,IAAI,QAAQ,MAAM;AAChE,YAAI,CAAC,QAAQ,KAAK,iBAAiB,KAAK,IAAI,MAAM,cAAc,CAAC;AACjE,aAAA;AAAA,MACF,GAAA;AAAA,IACF,CAAC;AAGD,QAAI,IAAI,WAAW,CAAC,KAAK,QAAQ;AAC/B,UAAI,QAAQ,QAAQ,CAAA,MAAK;AACvB,YAAI,OAAO,IAAI,MAAM,GAAG,EAAE,KAAK,EAAE;AAAA,MACnC,CAAC;AAAA,IACH,CAAC;AAED,SAAK,IAAI,IAAI,WAAW,OAAO;AAC/B,SAAK,IAAI,IAAI,WAAW,GAAG;AAG3B,SAAK,IAAI;AAAA,MACP;AAAA,MACAC,kCAAwB;AAAA,QACtB,QAAQC,MAAAA;AAAAA,QAAA,eACRC,KAAAA;AAAAA,MAAA,CACD;AAAA,IAAA;AAIHC,YAAAA,QAAa,IAAI;AAGjB,SAAK,IAAI,IAAI,OAAO,KAAK,QAAQ;AAC/B,UAAI,IAAI,QAAQ,YAAY;AAC1B,eAAO,IAAI,SAAS,KAAK,KAAK,aAAa,WAAW,CAAC;AAAA,MACzD;AACA,YAAM,OAAO,MAAM,KAAK,SAAS,aAAa,IAAI,QAAQ,MAAM;AAChE,YAAM,SAAS,QAAQ,CAAC,KAAK;AAC7B,UAAI,QAAQ;AACV,YAAI,SAAS,KAAK,KAAK,aAAa,UAAU,CAAC;AAAA,MACjD,OAAO;AACL,YAAI,SAAS,KAAK,KAAK,aAAa,WAAW,CAAC;AAAA,MAClD;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,QAAQ;AACZ,QAAI,KAAK,QAAS;AAClB,UAAM,KAAK;AACX,WAAO,MAAM,IAAI,QAAc,CAAA,YAAW;AACxC,WAAK,OAAO,OAAO,KAAK,MAAM,MAAM;AAClC;AAAA,UACE,GAAG,KAAK,KAAK;AAAA,UACb,OAAO,KAAK,QAAQ,MAAM,EAAE,gBAAgB,KAAK,IAAI,GAAG;AAAA,QAAA;AAE1D,aAAK,UAAU;AACf,aAAK,SAAS,WAAW,UAAU,CAAA,GAAI,gBAAgB;AACvD,gBAAA;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,OAAO;AACL,SAAK,SAAS,WAAW,UAAU,CAAA,GAAI,gBAAgB;AACvD,SAAK,OAAO,MAAA;AACZ,SAAK,UAAU;AACf,kBAAc,KAAK,oBAAoB;AAAA,EACzC;AACF;;"}

package/dist/webserver/backend/permissions.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const scopes = require("./scopes.js");
+var RootLevel = /* @__PURE__ */ ((RootLevel2) => {
+  RootLevel2["All"] = "all";
+  RootLevel2["Read"] = "read";
+  RootLevel2["Off"] = "off";
+  return RootLevel2;
+})(RootLevel || {});
+const EMPTY_PERMISSIONS = {
+  root: "off",
+  domains: {},
+  scopes: {}
+};
+const DOT_ENCODE = /\./g;
+const DOT_DECODE = /:/g;
+function encodeKeys(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) out[k.replace(DOT_ENCODE, ":")] = v;
+  return out;
+}
+function decodeKeys(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) out[k.replace(DOT_DECODE, ".")] = v;
+  return out;
+}
+function encodePermissions(p) {
+  return { root: p.root, domains: p.domains, scopes: encodeKeys(p.scopes) };
+}
+function decodePermissions(p) {
+  if (!p) return EMPTY_PERMISSIONS;
+  return {
+    root: p.root ?? "off",
+    domains: p.domains ?? {},
+    scopes: decodeKeys(p.scopes ?? {})
+  };
+}
+const ALL_SCOPES = Object.keys(scopes.SCOPES);
+function resolveScope(userPerms, defaultPerms, scopeName) {
+  if (scopeName === scopes.ScopeName.SessionInfo) return true;
+  const scopeDef = scopes.SCOPES[scopeName];
+  if (userPerms.root === "all") return true;
+  if (userPerms.root === "read") return scopeDef.readOnly;
+  const domain = userPerms.domains[scopeDef.domain];
+  if (domain === "all") return true;
+  if (domain === "read") return scopeDef.readOnly;
+  const scopeVal = userPerms.scopes[scopeName];
+  if (scopeVal === true) return true;
+  if (defaultPerms) return resolveScope(defaultPerms, null, scopeName);
+  return false;
+}
+function resolveAllScopes(userPerms, defaultPerms) {
+  const result = {};
+  for (const scope of ALL_SCOPES) {
+    result[scope] = resolveScope(userPerms, defaultPerms, scope);
+  }
+  return result;
+}
+function userHasScope(user, scope, defaultPerms) {
+  if (user.isOwner) return true;
+  return resolveScope(
+    user.permissions ?? EMPTY_PERMISSIONS,
+    defaultPerms,
+    scope
+  );
+}
+exports.EMPTY_PERMISSIONS = EMPTY_PERMISSIONS;
+exports.RootLevel = RootLevel;
+exports.decodePermissions = decodePermissions;
+exports.encodePermissions = encodePermissions;
+exports.resolveAllScopes = resolveAllScopes;
+exports.resolveScope = resolveScope;
+exports.userHasScope = userHasScope;
+//# sourceMappingURL=permissions.js.map

package/dist/webserver/backend/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sources":["../../../src/webserver/backend/permissions.ts"],"sourcesContent":["import { SCOPES, ScopeName, type Domain, type Scope } from './scopes';\n\nexport enum RootLevel {\n  All = 'all',\n  Read = 'read',\n  Off = 'off',\n}\n\nexport enum DomainLevel {\n  All = 'all',\n  Read = 'read',\n  None = 'none',\n}\n\nexport interface PermissionSet {\n  root: RootLevel;\n  domains: Partial<Record<Domain, DomainLevel>>;\n  scopes: Partial<Record<Scope, boolean>>;\n}\n\nexport const EMPTY_PERMISSIONS: PermissionSet = {\n  root: RootLevel.Off,\n  domains: {},\n  scopes: {},\n};\n\n// NeDB rejects field names containing dots, so we encode/decode\n// scope keys (e.g. \"server.status\") for storage\nconst DOT_ENCODE = /\\./g;\nconst DOT_DECODE = /:/g;\n\nfunction encodeKeys<V>(obj: Record<string, V>): Record<string, V> {\n  const out: Record<string, V> = {};\n  for (const [k, v] of Object.entries(obj)) out[k.replace(DOT_ENCODE, ':')] = v;\n  return out;\n}\n\nfunction decodeKeys<V>(obj: Record<string, V>): Record<string, V> {\n  const out: Record<string, V> = {};\n  for (const [k, v] of Object.entries(obj)) out[k.replace(DOT_DECODE, '.')] = v;\n  return out;\n}\n\nexport interface StoredPermissionSet {\n  root: RootLevel;\n  domains: Partial<Record<string, DomainLevel>>;\n  scopes: Record<string, boolean>;\n}\n\nexport function encodePermissions(p: PermissionSet): StoredPermissionSet {\n  return { root: p.root, domains: p.domains, scopes: encodeKeys(p.scopes) };\n}\n\nexport function decodePermissions(\n  p: StoredPermissionSet | null | undefined,\n): PermissionSet {\n  if (!p) return EMPTY_PERMISSIONS;\n  return {\n    root: p.root ?? RootLevel.Off,\n    domains: p.domains ?? {},\n    scopes: decodeKeys(p.scopes ?? {}),\n  };\n}\n\nconst ALL_SCOPES = Object.keys(SCOPES) as Scope[];\n\nexport function resolveScope(\n  userPerms: PermissionSet,\n  defaultPerms: PermissionSet | null,\n  scopeName: Scope,\n): boolean {\n  if (scopeName === ScopeName.SessionInfo) return true;\n\n  const scopeDef = SCOPES[scopeName];\n\n  // 1. Root\n  if (userPerms.root === RootLevel.All) return true;\n  if (userPerms.root === RootLevel.Read) return scopeDef.readOnly;\n\n  // 2. Domain\n  const domain = userPerms.domains[scopeDef.domain as Domain];\n  if (domain === DomainLevel.All) return true;\n  if (domain === DomainLevel.Read) return scopeDef.readOnly;\n\n  // 3. Scope (additive only - explicit true grants, false/absent falls through)\n  const scopeVal = userPerms.scopes[scopeName];\n  if (scopeVal === true) return true;\n\n  // 4. Fall back to defaults\n  if (defaultPerms) return resolveScope(defaultPerms, null, scopeName);\n\n  return false;\n}\n\nexport function resolveAllScopes(\n  userPerms: PermissionSet,\n  defaultPerms: PermissionSet | null,\n): Record<Scope, boolean> {\n  const result = {} as Record<Scope, boolean>;\n  for (const scope of ALL_SCOPES) {\n    result[scope] = resolveScope(userPerms, defaultPerms, scope);\n  }\n  return result;\n}\n\nexport function userHasScope(\n  user: { isOwner: boolean; permissions?: PermissionSet },\n  scope: Scope,\n  defaultPerms: PermissionSet | null,\n): boolean {\n  if (user.isOwner) return true;\n  return resolveScope(\n    user.permissions ?? EMPTY_PERMISSIONS,\n    defaultPerms,\n    scope,\n  );\n}\n"],"names":["RootLevel","SCOPES","ScopeName"],"mappings":";;;AAEO,IAAK,8BAAAA,eAAL;AACLA,aAAA,KAAA,IAAM;AACNA,aAAA,MAAA,IAAO;AACPA,aAAA,KAAA,IAAM;AAHI,SAAAA;AAAA,GAAA,aAAA,CAAA,CAAA;AAkBL,MAAM,oBAAmC;AAAA,EAC9C,MAAM;AAAA,EACN,SAAS,CAAA;AAAA,EACT,QAAQ,CAAA;AACV;AAIA,MAAM,aAAa;AACnB,MAAM,aAAa;AAEnB,SAAS,WAAc,KAA2C;AAChE,QAAM,MAAyB,CAAA;AAC/B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,EAAG,KAAI,EAAE,QAAQ,YAAY,GAAG,CAAC,IAAI;AAC5E,SAAO;AACT;AAEA,SAAS,WAAc,KAA2C;AAChE,QAAM,MAAyB,CAAA;AAC/B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,EAAG,KAAI,EAAE,QAAQ,YAAY,GAAG,CAAC,IAAI;AAC5E,SAAO;AACT;AAQO,SAAS,kBAAkB,GAAuC;AACvE,SAAO,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,SAAS,QAAQ,WAAW,EAAE,MAAM,EAAA;AACxE;AAEO,SAAS,kBACd,GACe;AACf,MAAI,CAAC,EAAG,QAAO;AACf,SAAO;AAAA,IACL,MAAM,EAAE,QAAQ;AAAA,IAChB,SAAS,EAAE,WAAW,CAAA;AAAA,IACtB,QAAQ,WAAW,EAAE,UAAU,CAAA,CAAE;AAAA,EAAA;AAErC;AAEA,MAAM,aAAa,OAAO,KAAKC,aAAM;AAE9B,SAAS,aACd,WACA,cACA,WACS;AACT,MAAI,cAAcC,OAAAA,UAAU,YAAa,QAAO;AAEhD,QAAM,WAAWD,OAAAA,OAAO,SAAS;AAGjC,MAAI,UAAU,SAAS,MAAe,QAAO;AAC7C,MAAI,UAAU,SAAS,OAAgB,QAAO,SAAS;AAGvD,QAAM,SAAS,UAAU,QAAQ,SAAS,MAAgB;AAC1D,MAAI,WAAW,MAAiB,QAAO;AACvC,MAAI,WAAW,OAAkB,QAAO,SAAS;AAGjD,QAAM,WAAW,UAAU,OAAO,SAAS;AAC3C,MAAI,aAAa,KAAM,QAAO;AAG9B,MAAI,aAAc,QAAO,aAAa,cAAc,MAAM,SAAS;AAEnE,SAAO;AACT;AAEO,SAAS,iBACd,WACA,cACwB;AACxB,QAAM,SAAS,CAAA;AACf,aAAW,SAAS,YAAY;AAC9B,WAAO,KAAK,IAAI,aAAa,WAAW,cAAc,KAAK;AAAA,EAC7D;AACA,SAAO;AACT;AAEO,SAAS,aACd,MACA,OACA,cACS;AACT,MAAI,KAAK,QAAS,QAAO;AACzB,SAAO;AAAA,IACL,KAAK,eAAe;AAAA,IACpB;AAAA,IACA;AAAA,EAAA;AAEJ;;;;;;;;"}

package/dist/webserver/backend/router/chat.js

@@ -3,12 +3,13 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const v4 = require("zod/v4");
 const EventEmitter = require("events");
 const trpc = require("../trpc.js");
+const scopes = require("../scopes.js");
 const events = require("../events.js");
 const logger = require("../../../logger.js");
 const chat = require("../../../util/chat.js");
 const chatRouter = trpc.router({
   chat: trpc.router({
-    send: trpc.protectedProcedure().input(v4.z.string()).mutation(async ({ input: message, ctx }) => {
+    send: trpc.protectedProcedure(scopes.ScopeName.ChatSend).input(v4.z.string()).mutation(async ({ input: message, ctx }) => {
       const { database, omegga } = trpc.getContextDeps();
       if (typeof message !== "string") return;
       if (message.length > 140) message = message.slice(0, 140);
@@ -26,11 +27,11 @@ const chatRouter = trpc.router({
       logger.default.log(`[${user.name.brightMagenta.underline}]: ${message}`);
       return "ok";
     }),
-    recent: trpc.protectedProcedure().query(() => {
+    recent: trpc.protectedProcedure(scopes.ScopeName.ChatRecent).query(() => {
       const { database } = trpc.getContextDeps();
       return database.getChats({ sameServer: true });
     }),
-    history: trpc.protectedProcedure().input(
+    history: trpc.protectedProcedure(scopes.ScopeName.ChatHistory).input(
       v4.z.object({
         after: v4.z.number().optional(),
         before: v4.z.number().optional()
@@ -39,14 +40,15 @@ const chatRouter = trpc.router({
       const { database } = trpc.getContextDeps();
       return database.getChats({ after: input.after, before: input.before });
     }),
-    calendar: trpc.protectedProcedure().query(() => {
+    calendar: trpc.protectedProcedure(scopes.ScopeName.ChatCalendar).query(() => {
       const { database } = trpc.getContextDeps();
       return database.calendar.years;
     }),
-    onMessage: trpc.protectedProcedure().subscription(
-      async function* ({ signal }) {
+    onMessage: trpc.protectedProcedure(scopes.ScopeName.ChatRecent).subscription(
+      async function* ({ signal, ctx }) {
+        const combined = AbortSignal.any([signal, ctx.userAbort.signal]);
         for await (const [chatLog] of EventEmitter.on(events.serverEvents, "chat", {
-          signal
+          signal: combined
         })) {
           yield chatLog;
         }

package/dist/webserver/backend/router/chat.js.map

@@ -1 +1 @@
-{"version":3,"file":"chat.js","sources":["../../../../src/webserver/backend/router/chat.ts"],"sourcesContent":["import { z } from 'zod/v4';\nimport { on } from 'events';\nimport { router, protectedProcedure, getContextDeps } from '../trpc';\nimport { serverEvents } from '../events';\nimport Logger from '@/logger';\nimport { parseLinks, sanitize } from '@util/chat';\n\nexport const chatRouter = router({\n  chat: router({\n    send: protectedProcedure('chat.send')\n      .input(z.string())\n      .mutation(async ({ input: message, ctx }) => {\n        const { database, omegga } = getContextDeps();\n\n        if (typeof message !== 'string') return;\n        if (message.length > 140) message = message.slice(0, 140);\n\n        const user = {\n          name: ctx.user.username || 'Admin',\n          id: ctx.user.playerId,\n          color: 'ff00ff',\n          web: true,\n        };\n\n        const chatLog = await database.addChatLog('msg', user, message);\n        serverEvents.emit('chat', chatLog);\n\n        omegga.broadcast(\n          `\"[<b><color=\\\\\"ff00ff\\\\\">${user.name}</></>]: ${parseLinks(sanitize(message))}\"`,\n        );\n        Logger.log(`[${user.name.brightMagenta.underline}]: ${message}`);\n\n        return 'ok';\n      }),\n\n    recent: protectedProcedure('chat.recent').query(() => {\n      const { database } = getContextDeps();\n      return database.getChats({ sameServer: true });\n    }),\n\n    history: protectedProcedure('chat.history')\n      .input(\n        z.object({\n          after: z.number().optional(),\n          before: z.number().optional(),\n        }),\n      )\n      .query(({ input }) => {\n        const { database } = getContextDeps();\n        return database.getChats({ after: input.after, before: input.before });\n      }),\n\n    calendar: protectedProcedure('chat.calendar').query(() => {\n      const { database } = getContextDeps();\n      return database.calendar.years;\n    }),\n\n    onMessage: protectedProcedure('chat.onMessage').subscription(\n      async function* ({ signal }) {\n        for await (const [chatLog] of on(serverEvents, 'chat', {\n          signal,\n        })) {\n          yield chatLog;\n        }\n      },\n    ),\n  }),\n});\n"],"names":["router","protectedProcedure","z","getContextDeps","serverEvents","parseLinks","sanitize","Logger","on"],"mappings":";;;;;;;;AAOO,MAAM,aAAaA,KAAAA,OAAO;AAAA,EAC/B,MAAMA,KAAAA,OAAO;AAAA,IACX,MAAMC,KAAAA,mBAA8B,EACjC,MAAMC,GAAAA,EAAE,OAAA,CAAQ,EAChB,SAAS,OAAO,EAAE,OAAO,SAAS,UAAU;AAC3C,YAAM,EAAE,UAAU,OAAA,IAAWC,oBAAA;AAE7B,UAAI,OAAO,YAAY,SAAU;AACjC,UAAI,QAAQ,SAAS,eAAe,QAAQ,MAAM,GAAG,GAAG;AAExD,YAAM,OAAO;AAAA,QACX,MAAM,IAAI,KAAK,YAAY;AAAA,QAC3B,IAAI,IAAI,KAAK;AAAA,QACb,OAAO;AAAA,QACP,KAAK;AAAA,MAAA;AAGP,YAAM,UAAU,MAAM,SAAS,WAAW,OAAO,MAAM,OAAO;AAC9DC,0BAAa,KAAK,QAAQ,OAAO;AAEjC,aAAO;AAAA,QACL,4BAA4B,KAAK,IAAI,YAAYC,KAAAA,WAAWC,KAAAA,SAAS,OAAO,CAAC,CAAC;AAAA,MAAA;AAEhFC,aAAAA,QAAO,IAAI,IAAI,KAAK,KAAK,cAAc,SAAS,MAAM,OAAO,EAAE;AAE/D,aAAO;AAAA,IACT,CAAC;AAAA,IAEH,QAAQN,KAAAA,mBAAgC,EAAE,MAAM,MAAM;AACpD,YAAM,EAAE,SAAA,IAAaE,oBAAA;AACrB,aAAO,SAAS,SAAS,EAAE,YAAY,MAAM;AAAA,IAC/C,CAAC;AAAA,IAED,SAASF,KAAAA,mBAAiC,EACvC;AAAA,MACCC,GAAAA,EAAE,OAAO;AAAA,QACP,OAAOA,GAAAA,EAAE,OAAA,EAAS,SAAA;AAAA,QAClB,QAAQA,GAAAA,EAAE,OAAA,EAAS,SAAA;AAAA,MAAS,CAC7B;AAAA,IAAA,EAEF,MAAM,CAAC,EAAE,YAAY;AACpB,YAAM,EAAE,SAAA,IAAaC,oBAAA;AACrB,aAAO,SAAS,SAAS,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,QAAQ;AAAA,IACvE,CAAC;AAAA,IAEH,UAAUF,KAAAA,mBAAkC,EAAE,MAAM,MAAM;AACxD,YAAM,EAAE,SAAA,IAAaE,oBAAA;AACrB,aAAO,SAAS,SAAS;AAAA,IAC3B,CAAC;AAAA,IAED,WAAWF,KAAAA,mBAAmC,EAAE;AAAA,MAC9C,iBAAiB,EAAE,OAAA,GAAU;AAC3B,yBAAiB,CAAC,OAAO,KAAKO,aAAAA,GAAGJ,OAAAA,cAAc,QAAQ;AAAA,UACrD;AAAA,QAAA,CACD,GAAG;AACF,gBAAM;AAAA,QACR;AAAA,MACF;AAAA,IAAA;AAAA,EACF,CACD;AACH,CAAC;;"}
+{"version":3,"file":"chat.js","sources":["../../../../src/webserver/backend/router/chat.ts"],"sourcesContent":["import { z } from 'zod/v4';\nimport { on } from 'events';\nimport { router, protectedProcedure, getContextDeps } from '../trpc';\nimport { ScopeName } from '../scopes';\nimport { serverEvents } from '../events';\nimport Logger from '@/logger';\nimport { parseLinks, sanitize } from '@util/chat';\n\nexport const chatRouter = router({\n  chat: router({\n    send: protectedProcedure(ScopeName.ChatSend)\n      .input(z.string())\n      .mutation(async ({ input: message, ctx }) => {\n        const { database, omegga } = getContextDeps();\n\n        if (typeof message !== 'string') return;\n        if (message.length > 140) message = message.slice(0, 140);\n\n        const user = {\n          name: ctx.user.username || 'Admin',\n          id: ctx.user.playerId,\n          color: 'ff00ff',\n          web: true,\n        };\n\n        const chatLog = await database.addChatLog('msg', user, message);\n        serverEvents.emit('chat', chatLog);\n\n        omegga.broadcast(\n          `\"[<b><color=\\\\\"ff00ff\\\\\">${user.name}</></>]: ${parseLinks(sanitize(message))}\"`,\n        );\n        Logger.log(`[${user.name.brightMagenta.underline}]: ${message}`);\n\n        return 'ok';\n      }),\n\n    recent: protectedProcedure(ScopeName.ChatRecent).query(() => {\n      const { database } = getContextDeps();\n      return database.getChats({ sameServer: true });\n    }),\n\n    history: protectedProcedure(ScopeName.ChatHistory)\n      .input(\n        z.object({\n          after: z.number().optional(),\n          before: z.number().optional(),\n        }),\n      )\n      .query(({ input }) => {\n        const { database } = getContextDeps();\n        return database.getChats({ after: input.after, before: input.before });\n      }),\n\n    calendar: protectedProcedure(ScopeName.ChatCalendar).query(() => {\n      const { database } = getContextDeps();\n      return database.calendar.years;\n    }),\n\n    onMessage: protectedProcedure(ScopeName.ChatRecent).subscription(\n      async function* ({ signal, ctx }) {\n        const combined = AbortSignal.any([signal!, ctx.userAbort.signal]);\n        for await (const [chatLog] of on(serverEvents, 'chat', {\n          signal: combined,\n        })) {\n          yield chatLog;\n        }\n      },\n    ),\n  }),\n});\n"],"names":["router","protectedProcedure","ScopeName","z","getContextDeps","serverEvents","parseLinks","sanitize","Logger","on"],"mappings":";;;;;;;;;AAQO,MAAM,aAAaA,KAAAA,OAAO;AAAA,EAC/B,MAAMA,KAAAA,OAAO;AAAA,IACX,MAAMC,KAAAA,mBAAmBC,OAAAA,UAAU,QAAQ,EACxC,MAAMC,GAAAA,EAAE,OAAA,CAAQ,EAChB,SAAS,OAAO,EAAE,OAAO,SAAS,UAAU;AAC3C,YAAM,EAAE,UAAU,OAAA,IAAWC,oBAAA;AAE7B,UAAI,OAAO,YAAY,SAAU;AACjC,UAAI,QAAQ,SAAS,eAAe,QAAQ,MAAM,GAAG,GAAG;AAExD,YAAM,OAAO;AAAA,QACX,MAAM,IAAI,KAAK,YAAY;AAAA,QAC3B,IAAI,IAAI,KAAK;AAAA,QACb,OAAO;AAAA,QACP,KAAK;AAAA,MAAA;AAGP,YAAM,UAAU,MAAM,SAAS,WAAW,OAAO,MAAM,OAAO;AAC9DC,0BAAa,KAAK,QAAQ,OAAO;AAEjC,aAAO;AAAA,QACL,4BAA4B,KAAK,IAAI,YAAYC,KAAAA,WAAWC,KAAAA,SAAS,OAAO,CAAC,CAAC;AAAA,MAAA;AAEhFC,aAAAA,QAAO,IAAI,IAAI,KAAK,KAAK,cAAc,SAAS,MAAM,OAAO,EAAE;AAE/D,aAAO;AAAA,IACT,CAAC;AAAA,IAEH,QAAQP,KAAAA,mBAAmBC,OAAAA,UAAU,UAAU,EAAE,MAAM,MAAM;AAC3D,YAAM,EAAE,SAAA,IAAaE,oBAAA;AACrB,aAAO,SAAS,SAAS,EAAE,YAAY,MAAM;AAAA,IAC/C,CAAC;AAAA,IAED,SAASH,KAAAA,mBAAmBC,iBAAU,WAAW,EAC9C;AAAA,MACCC,GAAAA,EAAE,OAAO;AAAA,QACP,OAAOA,GAAAA,EAAE,OAAA,EAAS,SAAA;AAAA,QAClB,QAAQA,GAAAA,EAAE,OAAA,EAAS,SAAA;AAAA,MAAS,CAC7B;AAAA,IAAA,EAEF,MAAM,CAAC,EAAE,YAAY;AACpB,YAAM,EAAE,SAAA,IAAaC,oBAAA;AACrB,aAAO,SAAS,SAAS,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,QAAQ;AAAA,IACvE,CAAC;AAAA,IAEH,UAAUH,KAAAA,mBAAmBC,OAAAA,UAAU,YAAY,EAAE,MAAM,MAAM;AAC/D,YAAM,EAAE,SAAA,IAAaE,oBAAA;AACrB,aAAO,SAAS,SAAS;AAAA,IAC3B,CAAC;AAAA,IAED,WAAWH,KAAAA,mBAAmBC,iBAAU,UAAU,EAAE;AAAA,MAClD,iBAAiB,EAAE,QAAQ,OAAO;AAChC,cAAM,WAAW,YAAY,IAAI,CAAC,QAAS,IAAI,UAAU,MAAM,CAAC;AAChE,yBAAiB,CAAC,OAAO,KAAKO,aAAAA,GAAGJ,OAAAA,cAAc,QAAQ;AAAA,UACrD,QAAQ;AAAA,QAAA,CACT,GAAG;AACF,gBAAM;AAAA,QACR;AAAA,MACF;AAAA,IAAA;AAAA,EACF,CACD;AACH,CAAC;;"}

package/dist/webserver/backend/router/index.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const trpc = require("../trpc.js");
 const chat = require("./chat.js");
+const mfa = require("./mfa.js");
 const player = require("./player.js");
 const plugin = require("./plugin.js");
 const role = require("./role.js");
@@ -17,7 +18,8 @@ const appRouter = trpc.mergeRouters(
   server.serverRouter,
   user.userRouter,
   world.worldRouter,
-  role.roleRouter
+  role.roleRouter,
+  mfa.mfaRouter
 );
 exports.appRouter = appRouter;
 //# sourceMappingURL=index.js.map

package/dist/webserver/backend/router/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../../src/webserver/backend/router/index.ts"],"sourcesContent":["import { mergeRouters } from '../trpc';\nimport { chatRouter } from './chat';\nimport { playerRouter } from './player';\nimport { pluginRouter } from './plugin';\nimport { roleRouter } from './role';\nimport { serverRouter } from './server';\nimport { sessionRouter } from './session';\nimport { userRouter } from './user';\nimport { worldRouter } from './world';\n\nexport const appRouter = mergeRouters(\n  sessionRouter,\n  chatRouter,\n  playerRouter,\n  pluginRouter,\n  serverRouter,\n  userRouter,\n  worldRouter,\n  roleRouter,\n);\n\nexport type AppRouter = typeof appRouter;\n"],"names":["mergeRouters","sessionRouter","chatRouter","playerRouter","pluginRouter","serverRouter","userRouter","worldRouter","roleRouter"],"mappings":";;;;;;;;;;;AAUO,MAAM,YAAYA,KAAAA;AAAAA,EACvBC,QAAAA;AAAAA,EACAC,KAAAA;AAAAA,EACAC,OAAAA;AAAAA,EACAC,OAAAA;AAAAA,EACAC,OAAAA;AAAAA,EACAC,KAAAA;AAAAA,EACAC,MAAAA;AAAAA,EACAC,KAAAA;AACF;;"}
+{"version":3,"file":"index.js","sources":["../../../../src/webserver/backend/router/index.ts"],"sourcesContent":["import { mergeRouters } from '../trpc';\nimport { chatRouter } from './chat';\nimport { mfaRouter } from './mfa';\nimport { playerRouter } from './player';\nimport { pluginRouter } from './plugin';\nimport { roleRouter } from './role';\nimport { serverRouter } from './server';\nimport { sessionRouter } from './session';\nimport { userRouter } from './user';\nimport { worldRouter } from './world';\n\nexport const appRouter = mergeRouters(\n  sessionRouter,\n  chatRouter,\n  playerRouter,\n  pluginRouter,\n  serverRouter,\n  userRouter,\n  worldRouter,\n  roleRouter,\n  mfaRouter,\n);\n\nexport type AppRouter = typeof appRouter;\n"],"names":["mergeRouters","sessionRouter","chatRouter","playerRouter","pluginRouter","serverRouter","userRouter","worldRouter","roleRouter","mfaRouter"],"mappings":";;;;;;;;;;;;AAWO,MAAM,YAAYA,KAAAA;AAAAA,EACvBC,QAAAA;AAAAA,EACAC,KAAAA;AAAAA,EACAC,OAAAA;AAAAA,EACAC,OAAAA;AAAAA,EACAC,OAAAA;AAAAA,EACAC,KAAAA;AAAAA,EACAC,MAAAA;AAAAA,EACAC,KAAAA;AAAAA,EACAC,IAAAA;AACF;;"}

package/dist/webserver/backend/router/mfa.js

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const bcrypt = require("bcryptjs");
+const crypto = require("crypto");
+const QRCode = require("qrcode");
+const server = require("@simplewebauthn/server");
+const v4 = require("zod/v4");
+const scopes = require("../scopes.js");
+const totp = require("../totp.js");
+const trpc = require("../trpc.js");
+function getRpID(req) {
+  const origin = req.headers.origin;
+  if (origin) {
+    try {
+      return new URL(origin).hostname;
+    } catch {
+    }
+  }
+  return req.hostname;
+}
+async function requirePassword(ctx, password) {
+  return bcrypt.compare(password, ctx.user.hash);
+}
+const mfaRouter = trpc.router({
+  mfa: trpc.router({
+    status: trpc.protectedProcedure(scopes.ScopeName.SessionInfo).query(({ ctx }) => {
+      const user = ctx.user;
+      return {
+        totpEnabled: user.totpEnabled ?? false,
+        passkeys: (user.passkeys ?? []).map((p) => ({
+          id: p.id,
+          name: p.name,
+          created: p.created,
+          lastUsed: p.lastUsed
+        })),
+        hasRecoveryCodes: (user.recoveryCodes?.length ?? 0) > 0
+      };
+    }),
+    totp: trpc.router({
+      setup: trpc.protectedProcedure(scopes.ScopeName.SessionInfo).input(v4.z.object({ password: v4.z.string() })).mutation(async ({ input, ctx }) => {
+        if (!await requirePassword(ctx, input.password)) {
+          return { error: "incorrect password" };
+        }
+        const secret = totp.generateSecret();
+        const uri = totp.generateURI(secret, ctx.user.username || "Admin");
+        const qrCode = await QRCode.toDataURL(uri);
+        ctx.req.session.pendingTotpSecret = secret;
+        ctx.req.session.save();
+        return { secret, uri, qrCode };
+      }),
+      enable: trpc.protectedProcedure(scopes.ScopeName.SessionInfo).input(v4.z.object({ code: v4.z.string() })).mutation(async ({ input, ctx }) => {
+        const { database } = trpc.getContextDeps();
+        const secret = ctx.req.session.pendingTotpSecret;
+        if (!secret) return "no pending TOTP setup";
+        if (!totp.verifyToken(input.code, secret)) {
+          return "invalid code";
+        }
+        await database.setUserTotp(ctx.user.username, secret, true);
+        delete ctx.req.session.pendingTotpSecret;
+        ctx.req.session.save();
+        return "";
+      }),
+      disable: trpc.protectedProcedure(scopes.ScopeName.SessionInfo).input(v4.z.object({ password: v4.z.string() })).mutation(async ({ input, ctx }) => {
+        const { database } = trpc.getContextDeps();
+        if (!await requirePassword(ctx, input.password)) {
+          return "incorrect password";
+        }
+        await database.disableUserTotp(ctx.user.username);
+        return "";
+      })
+    }),
+    passkey: trpc.router({
+      registerOptions: trpc.protectedProcedure(scopes.ScopeName.SessionInfo).mutation(
+        async ({ ctx }) => {
+          const rpID = getRpID(ctx.req);
+          const options = await server.generateRegistrationOptions({
+            rpName: "Omegga",
+            rpID,
+            userName: ctx.user.username || "Admin",
+            excludeCredentials: (ctx.user.passkeys ?? []).map((p) => ({
+              id: p.id,
+              transports: p.transports
+            })),
+            authenticatorSelection: {
+              residentKey: "preferred",
+              userVerification: "preferred"
+            }
+          });
+          ctx.req.session.mfaChallenge = options.challenge;
+          ctx.req.session.save();
+          return options;
+        }
+      ),
+      register: trpc.protectedProcedure(scopes.ScopeName.SessionInfo).input(
+        v4.z.object({
+          credential: v4.z.any(),
+          name: v4.z.string().max(64).default("Passkey")
+        })
+      ).mutation(async ({ input, ctx }) => {
+        const { database } = trpc.getContextDeps();
+        const challenge = ctx.req.session.mfaChallenge;
+        if (!challenge) return "no pending challenge";
+        delete ctx.req.session.mfaChallenge;
+        ctx.req.session.save();
+        try {
+          const verification = await server.verifyRegistrationResponse({
+            response: input.credential,
+            expectedChallenge: challenge,
+            expectedOrigin: ctx.req.headers.origin ?? `${ctx.req.protocol}://${ctx.req.get("host")}`,
+            expectedRPID: getRpID(ctx.req)
+          });
+          if (!verification.verified || !verification.registrationInfo) {
+            return "verification failed";
+          }
+          const { credential } = verification.registrationInfo;
+          await database.addPasskey(ctx.user.username, {
+            id: credential.id,
+            publicKey: Buffer.from(credential.publicKey).toString(
+              "base64url"
+            ),
+            counter: credential.counter,
+            name: input.name,
+            created: Date.now(),
+            lastUsed: 0,
+            transports: input.credential.response?.transports
+          });
+          return "";
+        } catch (e) {
+          console.error("Passkey registration error:", e);
+          return "registration failed";
+        }
+      }),
+      remove: trpc.protectedProcedure(scopes.ScopeName.SessionInfo).input(v4.z.object({ id: v4.z.string(), password: v4.z.string() })).mutation(async ({ input, ctx }) => {
+        const { database } = trpc.getContextDeps();
+        if (!await requirePassword(ctx, input.password)) {
+          return "incorrect password";
+        }
+        await database.removePasskey(ctx.user.username, input.id);
+        return "";
+      })
+    }),
+    recoveryCodes: trpc.router({
+      generate: trpc.protectedProcedure(scopes.ScopeName.SessionInfo).input(v4.z.object({ password: v4.z.string() })).mutation(async ({ input, ctx }) => {
+        const { database } = trpc.getContextDeps();
+        if (!await requirePassword(ctx, input.password)) {
+          return { error: "incorrect password" };
+        }
+        const codes = [];
+        const hashes = [];
+        for (let i = 0; i < 10; i++) {
+          const code = crypto.randomBytes(5).toString("hex");
+          codes.push(code);
+          hashes.push(await bcrypt.hash(code, 10));
+        }
+        await database.setRecoveryCodes(ctx.user.username, hashes);
+        return { codes };
+      })
+    })
+  })
+});
+exports.mfaRouter = mfaRouter;
+//# sourceMappingURL=mfa.js.map

package/dist/webserver/backend/router/mfa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa.js","sources":["../../../../src/webserver/backend/router/mfa.ts"],"sourcesContent":["import bcrypt from 'bcryptjs';\nimport crypto from 'crypto';\nimport QRCode from 'qrcode';\nimport {\n  generateRegistrationOptions,\n  verifyRegistrationResponse,\n} from '@simplewebauthn/server';\nimport { z } from 'zod/v4';\nimport { ScopeName } from '../scopes';\nimport { generateSecret, generateURI, verifyToken } from '../totp';\nimport { getContextDeps, protectedProcedure, router } from '../trpc';\n\nfunction getRpID(req: import('express').Request): string {\n  const origin = req.headers.origin;\n  if (origin) {\n    try {\n      return new URL(origin).hostname;\n    } catch {}\n  }\n  return req.hostname;\n}\n\nasync function requirePassword(ctx: any, password: string): Promise<boolean> {\n  return bcrypt.compare(password, ctx.user.hash);\n}\n\nexport const mfaRouter = router({\n  mfa: router({\n    status: protectedProcedure(ScopeName.SessionInfo).query(({ ctx }) => {\n      const user = ctx.user;\n      return {\n        totpEnabled: user.totpEnabled ?? false,\n        passkeys: (user.passkeys ?? []).map(p => ({\n          id: p.id,\n          name: p.name,\n          created: p.created,\n          lastUsed: p.lastUsed,\n        })),\n        hasRecoveryCodes: (user.recoveryCodes?.length ?? 0) > 0,\n      };\n    }),\n\n    totp: router({\n      setup: protectedProcedure(ScopeName.SessionInfo)\n        .input(z.object({ password: z.string() }))\n        .mutation(async ({ input, ctx }) => {\n          if (!(await requirePassword(ctx, input.password))) {\n            return { error: 'incorrect password' };\n          }\n          const secret = generateSecret();\n          const uri = generateURI(secret, ctx.user.username || 'Admin');\n          const qrCode = await QRCode.toDataURL(uri);\n          // store secret in session so enable can't accept arbitrary secrets\n          (ctx.req as any).session.pendingTotpSecret = secret;\n          (ctx.req as any).session.save();\n          return { secret, uri, qrCode };\n        }),\n\n      enable: protectedProcedure(ScopeName.SessionInfo)\n        .input(z.object({ code: z.string() }))\n        .mutation(async ({ input, ctx }) => {\n          const { database } = getContextDeps();\n          const secret = (ctx.req as any).session.pendingTotpSecret;\n          if (!secret) return 'no pending TOTP setup';\n          if (!verifyToken(input.code, secret)) {\n            return 'invalid code';\n          }\n          await database.setUserTotp(ctx.user.username, secret, true);\n          delete (ctx.req as any).session.pendingTotpSecret;\n          (ctx.req as any).session.save();\n          return '';\n        }),\n\n      disable: protectedProcedure(ScopeName.SessionInfo)\n        .input(z.object({ password: z.string() }))\n        .mutation(async ({ input, ctx }) => {\n          const { database } = getContextDeps();\n          if (!(await requirePassword(ctx, input.password))) {\n            return 'incorrect password';\n          }\n          await database.disableUserTotp(ctx.user.username);\n          return '';\n        }),\n    }),\n\n    passkey: router({\n      registerOptions: protectedProcedure(ScopeName.SessionInfo).mutation(\n        async ({ ctx }) => {\n          const rpID = getRpID(ctx.req);\n          const options = await generateRegistrationOptions({\n            rpName: 'Omegga',\n            rpID,\n            userName: ctx.user.username || 'Admin',\n            excludeCredentials: (ctx.user.passkeys ?? []).map(p => ({\n              id: p.id,\n              transports: p.transports as any,\n            })),\n            authenticatorSelection: {\n              residentKey: 'preferred',\n              userVerification: 'preferred',\n            },\n          });\n          (ctx.req as any).session.mfaChallenge = options.challenge;\n          (ctx.req as any).session.save();\n          return options;\n        },\n      ),\n\n      register: protectedProcedure(ScopeName.SessionInfo)\n        .input(\n          z.object({\n            credential: z.any(),\n            name: z.string().max(64).default('Passkey'),\n          }),\n        )\n        .mutation(async ({ input, ctx }) => {\n          const { database } = getContextDeps();\n          const challenge = (ctx.req as any).session.mfaChallenge;\n          if (!challenge) return 'no pending challenge';\n          // clear challenge immediately to prevent replay\n          delete (ctx.req as any).session.mfaChallenge;\n          (ctx.req as any).session.save();\n          try {\n            const verification = await verifyRegistrationResponse({\n              response: input.credential,\n              expectedChallenge: challenge,\n              expectedOrigin:\n                ctx.req.headers.origin ??\n                `${ctx.req.protocol}://${ctx.req.get('host')}`,\n              expectedRPID: getRpID(ctx.req),\n            });\n            if (!verification.verified || !verification.registrationInfo) {\n              return 'verification failed';\n            }\n            const { credential } = verification.registrationInfo;\n            await database.addPasskey(ctx.user.username, {\n              id: credential.id,\n              publicKey: Buffer.from(credential.publicKey).toString(\n                'base64url',\n              ),\n              counter: credential.counter,\n              name: input.name,\n              created: Date.now(),\n              lastUsed: 0,\n              transports: input.credential.response?.transports,\n            });\n            return '';\n          } catch (e) {\n            console.error('Passkey registration error:', e);\n            return 'registration failed';\n          }\n        }),\n\n      remove: protectedProcedure(ScopeName.SessionInfo)\n        .input(z.object({ id: z.string(), password: z.string() }))\n        .mutation(async ({ input, ctx }) => {\n          const { database } = getContextDeps();\n          if (!(await requirePassword(ctx, input.password))) {\n            return 'incorrect password';\n          }\n          await database.removePasskey(ctx.user.username, input.id);\n          return '';\n        }),\n    }),\n\n    recoveryCodes: router({\n      generate: protectedProcedure(ScopeName.SessionInfo)\n        .input(z.object({ password: z.string() }))\n        .mutation(async ({ input, ctx }) => {\n          const { database } = getContextDeps();\n          if (!(await requirePassword(ctx, input.password))) {\n            return { error: 'incorrect password' };\n          }\n          const codes: string[] = [];\n          const hashes: string[] = [];\n          for (let i = 0; i < 10; i++) {\n            const code = crypto.randomBytes(5).toString('hex');\n            codes.push(code);\n            hashes.push(await bcrypt.hash(code, 10));\n          }\n          await database.setRecoveryCodes(ctx.user.username, hashes);\n          return { codes };\n        }),\n    }),\n  }),\n});\n"],"names":["router","protectedProcedure","ScopeName","z","generateSecret","generateURI","getContextDeps","verifyToken","generateRegistrationOptions","verifyRegistrationResponse"],"mappings":";;;;;;;;;;AAYA,SAAS,QAAQ,KAAwC;AACvD,QAAM,SAAS,IAAI,QAAQ;AAC3B,MAAI,QAAQ;AACV,QAAI;AACF,aAAO,IAAI,IAAI,MAAM,EAAE;AAAA,IACzB,QAAQ;AAAA,IAAC;AAAA,EACX;AACA,SAAO,IAAI;AACb;AAEA,eAAe,gBAAgB,KAAU,UAAoC;AAC3E,SAAO,OAAO,QAAQ,UAAU,IAAI,KAAK,IAAI;AAC/C;AAEO,MAAM,YAAYA,KAAAA,OAAO;AAAA,EAC9B,KAAKA,KAAAA,OAAO;AAAA,IACV,QAAQC,KAAAA,mBAAmBC,iBAAU,WAAW,EAAE,MAAM,CAAC,EAAE,UAAU;AACnE,YAAM,OAAO,IAAI;AACjB,aAAO;AAAA,QACL,aAAa,KAAK,eAAe;AAAA,QACjC,WAAW,KAAK,YAAY,CAAA,GAAI,IAAI,CAAA,OAAM;AAAA,UACxC,IAAI,EAAE;AAAA,UACN,MAAM,EAAE;AAAA,UACR,SAAS,EAAE;AAAA,UACX,UAAU,EAAE;AAAA,QAAA,EACZ;AAAA,QACF,mBAAmB,KAAK,eAAe,UAAU,KAAK;AAAA,MAAA;AAAA,IAE1D,CAAC;AAAA,IAED,MAAMF,KAAAA,OAAO;AAAA,MACX,OAAOC,KAAAA,mBAAmBC,iBAAU,WAAW,EAC5C,MAAMC,GAAAA,EAAE,OAAO,EAAE,UAAUA,GAAAA,EAAE,OAAA,EAAO,CAAG,CAAC,EACxC,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAI,CAAE,MAAM,gBAAgB,KAAK,MAAM,QAAQ,GAAI;AACjD,iBAAO,EAAE,OAAO,qBAAA;AAAA,QAClB;AACA,cAAM,SAASC,KAAAA,eAAA;AACf,cAAM,MAAMC,KAAAA,YAAY,QAAQ,IAAI,KAAK,YAAY,OAAO;AAC5D,cAAM,SAAS,MAAM,OAAO,UAAU,GAAG;AAExC,YAAI,IAAY,QAAQ,oBAAoB;AAC5C,YAAI,IAAY,QAAQ,KAAA;AACzB,eAAO,EAAE,QAAQ,KAAK,OAAA;AAAA,MACxB,CAAC;AAAA,MAEH,QAAQJ,KAAAA,mBAAmBC,iBAAU,WAAW,EAC7C,MAAMC,GAAAA,EAAE,OAAO,EAAE,MAAMA,GAAAA,EAAE,OAAA,EAAO,CAAG,CAAC,EACpC,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,cAAM,EAAE,SAAA,IAAaG,oBAAA;AACrB,cAAM,SAAU,IAAI,IAAY,QAAQ;AACxC,YAAI,CAAC,OAAQ,QAAO;AACpB,YAAI,CAACC,KAAAA,YAAY,MAAM,MAAM,MAAM,GAAG;AACpC,iBAAO;AAAA,QACT;AACA,cAAM,SAAS,YAAY,IAAI,KAAK,UAAU,QAAQ,IAAI;AAC1D,eAAQ,IAAI,IAAY,QAAQ;AAC/B,YAAI,IAAY,QAAQ,KAAA;AACzB,eAAO;AAAA,MACT,CAAC;AAAA,MAEH,SAASN,KAAAA,mBAAmBC,iBAAU,WAAW,EAC9C,MAAMC,GAAAA,EAAE,OAAO,EAAE,UAAUA,GAAAA,EAAE,OAAA,EAAO,CAAG,CAAC,EACxC,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,cAAM,EAAE,SAAA,IAAaG,oBAAA;AACrB,YAAI,CAAE,MAAM,gBAAgB,KAAK,MAAM,QAAQ,GAAI;AACjD,iBAAO;AAAA,QACT;AACA,cAAM,SAAS,gBAAgB,IAAI,KAAK,QAAQ;AAChD,eAAO;AAAA,MACT,CAAC;AAAA,IAAA,CACJ;AAAA,IAED,SAASN,KAAAA,OAAO;AAAA,MACd,iBAAiBC,KAAAA,mBAAmBC,iBAAU,WAAW,EAAE;AAAA,QACzD,OAAO,EAAE,IAAA,MAAU;AACjB,gBAAM,OAAO,QAAQ,IAAI,GAAG;AAC5B,gBAAM,UAAU,MAAMM,mCAA4B;AAAA,YAChD,QAAQ;AAAA,YACR;AAAA,YACA,UAAU,IAAI,KAAK,YAAY;AAAA,YAC/B,qBAAqB,IAAI,KAAK,YAAY,IAAI,IAAI,CAAA,OAAM;AAAA,cACtD,IAAI,EAAE;AAAA,cACN,YAAY,EAAE;AAAA,YAAA,EACd;AAAA,YACF,wBAAwB;AAAA,cACtB,aAAa;AAAA,cACb,kBAAkB;AAAA,YAAA;AAAA,UACpB,CACD;AACA,cAAI,IAAY,QAAQ,eAAe,QAAQ;AAC/C,cAAI,IAAY,QAAQ,KAAA;AACzB,iBAAO;AAAA,QACT;AAAA,MAAA;AAAA,MAGF,UAAUP,KAAAA,mBAAmBC,iBAAU,WAAW,EAC/C;AAAA,QACCC,GAAAA,EAAE,OAAO;AAAA,UACP,YAAYA,GAAAA,EAAE,IAAA;AAAA,UACd,MAAMA,GAAAA,EAAE,OAAA,EAAS,IAAI,EAAE,EAAE,QAAQ,SAAS;AAAA,QAAA,CAC3C;AAAA,MAAA,EAEF,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,cAAM,EAAE,SAAA,IAAaG,oBAAA;AACrB,cAAM,YAAa,IAAI,IAAY,QAAQ;AAC3C,YAAI,CAAC,UAAW,QAAO;AAEvB,eAAQ,IAAI,IAAY,QAAQ;AAC/B,YAAI,IAAY,QAAQ,KAAA;AACzB,YAAI;AACF,gBAAM,eAAe,MAAMG,kCAA2B;AAAA,YACpD,UAAU,MAAM;AAAA,YAChB,mBAAmB;AAAA,YACnB,gBACE,IAAI,IAAI,QAAQ,UAChB,GAAG,IAAI,IAAI,QAAQ,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC;AAAA,YAC9C,cAAc,QAAQ,IAAI,GAAG;AAAA,UAAA,CAC9B;AACD,cAAI,CAAC,aAAa,YAAY,CAAC,aAAa,kBAAkB;AAC5D,mBAAO;AAAA,UACT;AACA,gBAAM,EAAE,eAAe,aAAa;AACpC,gBAAM,SAAS,WAAW,IAAI,KAAK,UAAU;AAAA,YAC3C,IAAI,WAAW;AAAA,YACf,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE;AAAA,cAC3C;AAAA,YAAA;AAAA,YAEF,SAAS,WAAW;AAAA,YACpB,MAAM,MAAM;AAAA,YACZ,SAAS,KAAK,IAAA;AAAA,YACd,UAAU;AAAA,YACV,YAAY,MAAM,WAAW,UAAU;AAAA,UAAA,CACxC;AACD,iBAAO;AAAA,QACT,SAAS,GAAG;AACV,kBAAQ,MAAM,+BAA+B,CAAC;AAC9C,iBAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,MAEH,QAAQR,KAAAA,mBAAmBC,OAAAA,UAAU,WAAW,EAC7C,MAAMC,KAAE,OAAO,EAAE,IAAIA,GAAAA,EAAE,OAAA,GAAU,UAAUA,KAAE,SAAO,CAAG,CAAC,EACxD,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,cAAM,EAAE,SAAA,IAAaG,oBAAA;AACrB,YAAI,CAAE,MAAM,gBAAgB,KAAK,MAAM,QAAQ,GAAI;AACjD,iBAAO;AAAA,QACT;AACA,cAAM,SAAS,cAAc,IAAI,KAAK,UAAU,MAAM,EAAE;AACxD,eAAO;AAAA,MACT,CAAC;AAAA,IAAA,CACJ;AAAA,IAED,eAAeN,KAAAA,OAAO;AAAA,MACpB,UAAUC,KAAAA,mBAAmBC,iBAAU,WAAW,EAC/C,MAAMC,GAAAA,EAAE,OAAO,EAAE,UAAUA,GAAAA,EAAE,OAAA,EAAO,CAAG,CAAC,EACxC,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,cAAM,EAAE,SAAA,IAAaG,oBAAA;AACrB,YAAI,CAAE,MAAM,gBAAgB,KAAK,MAAM,QAAQ,GAAI;AACjD,iBAAO,EAAE,OAAO,qBAAA;AAAA,QAClB;AACA,cAAM,QAAkB,CAAA;AACxB,cAAM,SAAmB,CAAA;AACzB,iBAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,gBAAM,OAAO,OAAO,YAAY,CAAC,EAAE,SAAS,KAAK;AACjD,gBAAM,KAAK,IAAI;AACf,iBAAO,KAAK,MAAM,OAAO,KAAK,MAAM,EAAE,CAAC;AAAA,QACzC;AACA,cAAM,SAAS,iBAAiB,IAAI,KAAK,UAAU,MAAM;AACzD,eAAO,EAAE,MAAA;AAAA,MACX,CAAC;AAAA,IAAA,CACJ;AAAA,EAAA,CACF;AACH,CAAC;;"}